paypal

app/api/payments/webhook/route.ts

@@ -0,0 +1,85 @@
+export const runtime = "nodejs";
+
+import { NextRequest, NextResponse } from "next/server";
+import { verifyWebhookSignature } from "@/lib/paypal";
+import { markPaymentPaid } from "@/lib/summit-requests";
+
+export async function POST(req: NextRequest): Promise<NextResponse> {
+  // Read raw body as text for signature verification
+  const rawBody = await req.text();
+
+  // Parse the body as JSON
+  const event = JSON.parse(rawBody);
+
+  // Read required PayPal signature headers
+  const transmissionId = req.headers.get("paypal-transmission-id");
+  const transmissionTime = req.headers.get("paypal-transmission-time");
+  const certUrl = req.headers.get("paypal-cert-url");
+  const authAlgo = req.headers.get("paypal-auth-algo");
+  const transmissionSig = req.headers.get("paypal-transmission-sig");
+
+  // Return 401 if any required header is missing
+  if (!transmissionId || !transmissionTime || !certUrl || !authAlgo || !transmissionSig) {
+    return NextResponse.json(
+      { error: "Missing PayPal signature headers." },
+      { status: 401 }
+    );
+  }
+
+  // Verify webhook signature
+  const isValid = await verifyWebhookSignature({
+    authAlgo,
+    certUrl,
+    transmissionId,
+    transmissionSig,
+    transmissionTime,
+    webhookId: process.env.PAYPAL_WEBHOOK_ID ?? "",
+    webhookEvent: event,
+  });
+
+  if (!isValid) {
+    return NextResponse.json(
+      { error: "Invalid webhook signature." },
+      { status: 401 }
+    );
+  }
+
+  console.log(
+    "[webhook] Received event:",
+    event.event_type,
+    "resource_id:",
+    event.resource?.id,
+    "transmission_id:",
+    transmissionId
+  );
+
+  try {
+    if (event.event_type === "PAYMENT.CAPTURE.COMPLETED") {
+      const orderId =
+        event.resource?.supplementary_data?.related_ids?.order_id ??
+        event.resource?.id;
+
+      const result = await markPaymentPaid(orderId, event.resource.id);
+      console.log(
+        "[webhook] markPaymentPaid result for orderId:",
+        orderId,
+        "captureId:",
+        event.resource.id,
+        result
+      );
+
+      return NextResponse.json({ received: true }, { status: 200 });
+    }
+
+    // All other event types — acknowledge and ignore
+    console.log("[webhook] Ignoring unhandled event type:", event.event_type);
+    return NextResponse.json({ received: true }, { status: 200 });
+  } catch (err) {
+    console.error("[webhook] Internal error processing event:", event.event_type, err);
+    // Return 500 so PayPal retries the webhook
+    return NextResponse.json(
+      { error: "Internal server error." },
+      { status: 500 }
+    );
+  }
+}